# CVE-2026-48044: Envoy Zstd decompressor memory exhaustion Denial of Service

Source: https://junglewise.ai/threats/cve-2026-48044-envoy-zstd-decompressor-memory-exhaustion-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-48044 · Severity: high · CVSS 7.5 · Published 2026-06-26

Envoy is a widely used service proxy that manages network traffic for cloud applications. A vulnerability in its Zstd decompression component allows an attacker to send a specially crafted, highly compressed data packet that causes the proxy to consume massive amounts of memory. This can lead to the proxy crashing or being shut down by the operating system, resulting in a total service outage for all applications relying on that Envoy instance.

Technologies: [Envoy Proxy Envoy](https://junglewise.ai/threats/technologies/envoy). Vendors: [Envoy Proxy](https://junglewise.ai/threats/vendors/envoy-proxy).

## Quick answers

**Is CVE-2026-48044 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48044 being exploited in the wild.

**How severe is CVE-2026-48044?** High severity, with a CVSS score of 7.5, published 26 June 2026.

**Which products and versions are affected?** Envoy Proxy Envoy >= 1.23.0, < 1.35.11; >= 1.36.0, < 1.36.7; >= 1.37.0, < 1.37.3; >= 1.38.0, < 1.38.1.

**Is there a fix for CVE-2026-48044?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48044 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-48044?** Check whether you run Envoy Proxy Envoy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource exhaustion vulnerability (CWE-409/CWE-400) exists in Envoy's ZstdDecompressorImpl due to improper placement of inflation ratio checks. While Envoy defines a MaxInflateRatio to prevent decompression bombs, the check is performed in the outer loop after a full data slice has been processed, rather than within the inner processing loop. An attacker can send a small, highly compressed Zstd payload that expands to hundreds of megabytes during a single 'process()' call, bypassing the limit check until the memory has already been allocated. This leads to an Out-Of-Memory (OOM) termination of the Envoy process. The vulnerability is reachable over the network without authentication if Zstd decompression is enabled. Patches are available in versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

## Affected products

- Envoy Proxy Envoy >= 1.23.0, < 1.35.11; >= 1.36.0, < 1.36.7; >= 1.37.0, < 1.37.3; >= 1.38.0, < 1.38.1

## Timeline

- 2026-06-23: advisory: GitHub Security Advisory published by maintainers
- 2026-06-26: disclosed: CVE published to NVD

## References

- [https://github.com/envoyproxy/envoy/security/advisories/GHSA-m3p9-47wh-88wg](https://github.com/envoyproxy/envoy/security/advisories/GHSA-m3p9-47wh-88wg)

## Related threats

- [Envoy HTTP upgrade connection poisoning](https://junglewise.ai/threats/cve-2026-73548-envoy-is-an-open-source-edge-and-service-proxy-designed-for-cloud)
- [Envoy use-after-free in HTTP OAuth2 filter](https://junglewise.ai/threats/cve-2026-48090-envoy-use-after-free-in-http-oauth2-filter)
- [Envoy denial of service via NULL pointer dereference in log formatting](https://junglewise.ai/threats/cve-2026-47220-envoy-denial-of-service-via-null-pointer-dereference-in-log)
- [Envoy Use-After-Free in ext_authz filter during stream teardown](https://junglewise.ai/threats/cve-2026-47205-envoy-use-after-free-in-ext-authz-filter-during-stream-teardown)
- [Envoy HTTP/3 to HTTP/1 request smuggling in downstream translation](https://junglewise.ai/threats/cve-2026-48743-envoy-http-3-to-http-1-request-smuggling-in-downstream)